Growing Cyber Threats Require U.S. Allies To Implement a Zero Trust Strategy

The U.S. military cannot fight a high-end conflict without a coalition of friends and allies. In order to conduct effective joint operations, all parties must be able to share information rapidly across secure networks. Unfortunately, adversaries such as China and Russia are conducting continuous cyberattacks on critical allied networks, often with significant success. For the U.S. to have confidence in sharing data with allies, those countries must begin now to implement a program of Zero Trust cybersecurity.

Defending against this growing threat is made more difficult by the COVID-19 pandemic and the need the need for millions of government workers to operate remotely. Also contributing to this problem is the growth of the so-called Internet of Things, which involves connecting billions of sensors and other devices. There is also the related Internet of Military Things, which includes traditional computers and communications devices, as well as embedded sensors and devices on platforms, weapons systems, and equipment. All this massively increases the number of endpoints on networks. U.S. government networks, particularly those operated by the Department of Defense (DoD), are the world’s largest, most complex, and most vulnerable.

Moreover, the U.S. military is looking to shorten sensor-to-shooter timelines from minutes and hours to a matter of seconds. High-speed data management and targeting cannot be based on networks that are chronically vulnerable to penetrations.

Adding to the challenges of safeguarding the continually evolving and expanding U.S. defense and security networks is the need to ensure that connectivity with allies and coalition partners is secure. This is no easy task, given the differences in the ways individual countries manage network security. In addition, the U.S. military will be reluctant to share data with coalition partners or to use the information they provide if they cannot trust the security of their networks. At the same time, allies and partners are concerned that they will be unable to operate alongside U.S. forces if they lack the ability to securely link to U.S. forces and databases.

The consequence of the geometric expansion in the size and complexity of critical networks is that traditional approaches are no longer adequate to defend them from cyberattacks. Senior U.S. cyber officials have recognized the need to move beyond these approaches and implement a strategy called Zero Trust. Zero Trust takes as a foundational principle the idea that a network is always at risk of being penetrated and that all users must be continually authenticated and authorized. It is never assumed that an endpoint or user is legitimate simply because they have access to a network or database. All activities on every network must be monitorable and unauthorized users or devices must be rapidly identified and isolated.

A major element of DoD’s approach to implementing Zero Trust is called Comply-to-Connect (C2C). As the name suggests, C2C requires that all endpoints and users on a defense department network be identified, authenticated, qualified, and continually monitored. Because of the speed at which defense networks need to operate, important functions such as monitoring, incident response, and remediation are automated. Based on C2C tools and techniques, DoD networks will be able to operate at speed even while under continuous attack.

The defense department has made major strides in implementing C2C. As the Department moves to create the much anticipated Joint All Domain Command and Control (JADC2) network of networks, connecting sensors and shooters across services, defense agencies, plus allies and coalition partners, it will be imperative to expand C2C to both joint and coalition networks. The Pentagon has set a target of applying C2C to all its networks within five years.

Zero Trust is also being implemented in other federal departments and agencies. The Department of Homeland Security is pushing the federal government to adopt the Continuous Diagnostics and Mitigation (CDM) program. CDM allows users to identify who is on their networks and assess whether they are authentic, have the appropriate security capabilities, and are operating in a safe and secure manner. Like C2C, CDM automates many routine monitoring and security functions and provides for more rapid incident response and threat mitigation than can be achieved with human operators alone. In addition, CDM’s ability to continuously monitor networks allows for rapid identification of threats and vulnerabilities. It also creates the capability to rapidly send warning notices to vulnerable departments and agencies.

It is becoming clear that even as the U.S. moves towards implementing Zero Trust on all government networks, major allies are falling behind. The recent Chinese attack on Japanese defense networks is indicative of the problem. Japan, Australia, and other allied countries need to consider pursuing a strategy based on the Zero Trust approach. Capabilities such as C2C and CDM have proven their worth over the years, and it would be wise for all U.S. partners to adopt them.

Dan Gouré, Ph.D., is a vice president at the public-policy research think tank Lexington Institute. Gouré has a background in the public sector and U.S. federal government, most recently serving as a member of the 2001 Department of Defense Transition Team. You can follow him on Twitter at @dgoure and the Lexington Institute @LexNextDC. Read his full bio here.